Ambrosetti S.p.A. – €85,000 Fine (Italy, 2026)

Ambrosetti S.p.A. (the controller) is a consulting company. In 2024 the controller informed the DPA of a data breach, in accordance with Article 33 GDPR. The controller estimated that the data breach could have affected around 134,000 data subjects (later lowered to approximately 62,000), and concerned their contact details and login credentials. In addition, the controller stated that it was unlikely that the data breach posed a high risk for data subjects, since the credential data was the initial registration credentials set by the controller and not the user. Finally, the controller stated that it had hired external staff to develop a large number of their systems, and it had assumed that the system security was also monitored by the external staff. During its investigations, the DPA found that some of the passwords in question appeared to be set by the data subjects and not the controller. The controller did not initially inform the affected data subjects, but later contacted data subjects it had an email address on file. The controller also published a notice on its website and contacted news outlets. The DPA found a violation of Article 34 GDPR, as the controller failed to inform data subjects within the time limit, and had failed to justify the delay. The DPA considered that the data breach was likely to pose a high risk to the rights and freedoms of data subjects, and therefore, the controller had the obligation to inform them. The DPA took into consideration data subjects’ tendency to reuse passwords, the high number of affected data subjects, and the fact that the controller did not inform the data subjects until the DPA ordered it to do so during its investigations. The DPA also found a violation of Article 5(1)(e) GDPR, as the controller had failed to comply with the principles of storage limitation. The DPA found that the controller retained authentication credentials when it was no longer needed (e.g. certain systems that were no longer in use). The DPA found that it was not necessary for the controller to store this data, especially considering the risks to data subjects’ rights and freedoms. Finally, the DPA found a violation of Articles 5(1)(f) and 32 GDPR, as the controller failed to ensure security of processing. The DPA found that the controller stored a portion of the data subjects’ passwords in plain text. In addition, the DPA found that another portion of passwords (around 98,000) were not stored in a sufficiently robust manner. The DPA fined the controller €85,000.